Closed Bug 1582827 Opened 5 years ago Closed 5 years ago

[lando-ui] Sanitize new commit messages when requesting sec-approval

Categories

(Conduit :: Lando, task, P2)

Product:
Conduit
Component:
Lando
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED INVALID

People

(Reporter: mars, Assigned: mars)

References

(Blocks 1 open bug)

Details

(Keywords: conduit-triaged)

Commit messages being submitted to Lando for sec-approval need to be properly sanitized to prevent an XSS attack.

Assignee: nobody → mars
Status: NEW → ASSIGNED
Keywords: conduit-triaged
Priority: -- → P2

glob says that Phabricator does output sanitization. The commit messages submitted via lando-ui ultimately show up in Phabricator and Lando, both of which escape the HTML before displaying it. We don't need to sanitize the submitted commit messages.

Status: ASSIGNED → RESOLVED
Closed: 5 years ago
Resolution: --- → INVALID
You need to log in before you can comment on or make changes to this bug.